Module Summary

What you learned in this module

ID0 is the argument for the rest of the course. It does not teach a control or a query; it establishes what this subject is about and why the obvious approach to it fails. Here is what you now understand.

A control that is switched on is not a control that is working (Section 0.1). Northgate ran 214 analytics rules, 47 of them identity, and lost nineteen days to a stolen session token. One rule fired on day two and was closed as benign by an analyst who had correctly closed forty impossible-travel alerts that week. A second would have caught it on day one, was enabled, was correct, and queried a table the tenant does not ingest. Neither failure is visible from the rule, which is why this course is organized around whether a thing is doing anything rather than around whether it exists.

Four tables hold identity authentication and a rule against the wrong one returns nothing (Section 0.2). SigninLogs is interactive only and is roughly 7 per cent of the volume. AADNonInteractiveUserSignInLogs holds everything a client does afterwards and is the largest by an order of magnitude. AADServicePrincipalSignInLogs holds identities with no person attached, and nothing in it can be found by a query that joins on a user. AuditLogs records change rather than authentication, which is where most identity persistence lives. An empty result is indistinguishable from a quiet estate.

A detection is five things and the query is the one least likely to be wrong (Section 0.3). The data it depends on, the query, the threshold somebody chose, the routing that decides who is told, and the person who reads it. Only the query announces its own failure, and only at the moment you write it. Everything to its right reports success indefinitely while producing nothing, which is how an estate becomes simultaneously well maintained and inert.

The attacks worth detecting are the ones prevention does not stop (Section 0.4). Password spray is 97 per cent of identity attacks and is answered by any second factor. What reaches a well-configured tenant is token theft, consent phishing, workload compromise and standing privilege, and none of them touches a password. A quarter with 41,200 blocked password attempts and 69 days of unauthorized access is not a contradiction.

The evidence for an identity attack is the evidence for ordinary administration (Section 0.5). A credential addition and a credential rotation are the same record in every field the audit log carries. That is structural rather than a logging deficiency, because the attack is the legitimate action performed by the wrong person. Detection therefore becomes a join against a process rather than a pattern match, and it inherits the quality of the process it joins against.

Most of the identities in a tenant are not people (Section 0.6). Northgate holds 1,431 identities against 810 staff. MFA cannot apply to a service principal because there is nobody to challenge, and a Conditional Access policy scoped to all users does not include one. The number that decides everything is not the 461 service principals but the 340 with no owner, because you cannot ask whether an identity is still needed without somebody to ask.

Configuration is a project and operations is a cadence (Section 0.7). Fourteen months after a signed-off identity project: four policies still in report-only, a break-glass account never signed into, 31 credentials replaced with five-year ones during an out-of-hours outage, and a log category switched off in a cost review. Nobody decided to weaken anything. Drift is the default state, and the question is not how to prevent it but how quickly it becomes visible.

Three surfaces, and the question decides which one (Section 0.8). The portal answers about one object in depth and holds the only counterfactual tool in the product. Graph answers about every object in current state and produces something you can keep. KQL answers what happened. Asking a configuration question of a log returns a plausible answer to a question you did not ask, which is worse than returning nothing.

A number that can only go up is measuring effort rather than the estate (Section 0.9). The same tenant on the same day reports 94 per cent, 55, 41 or 14 depending on whether workload identities count, whether report-only counts as coverage, and whether coverage means somebody would find out if the control failed. The test for a metric is whether you can name in advance the specific thing that would make it fall.

The scarce resource in a lab is history, not a tenant (Section 0.10). Every other requirement is met in an afternoon. A tenant with no past has no normal, and identity detection is the business of departing from normal, so an estate you can read matters more than one you can change.

What's next

ID1 starts with the population section 0.6 counted and nothing in this tenant reaches. Workload identities authenticate with secrets that outlive the people who created them, no interactive control applies to them, and in most estates nobody can name an owner for the majority. The module opens on an inventory rather than a detection, for the reason section 0.5 gave: counting the credentials that should not exist is unarguable, and watching for the moment somebody creates one is a rule with a threshold, a join and a false positive rate.